[英]how to pass an assume role in terratest
我正在為 terraform 模塊編寫測試用例。 我有一個假設角色,我想將它傳遞給我的 go 測試。 我不知道如何通過它。 我將它定義為一個常量,然后我應該如何傳遞它,以便在 terraform init 和 terraform apply, destroy 期間調用它。
package test
import (
"testing"
"github.com/gruntwork-io/terratest/modules/aws"
"github.com/gruntwork-io/terratest/modules/terraform"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
)
// An example of how to test the Terraform module in examples/terraform-aws-network-example using Terratest.
func TestTerraformAwsNetworkExample(t *testing.T) {
t.Parallel()
const authAssumeRoleEnvVar = "TERRATEST_IAM_ROLE"
// Give the VPC and the subnets correct CIDRs
vpcCidr := "1x.x.x.x/20"
Env := "staging"
privateSubnetCidr := []string{"1x.x.x.x/30"}
publicSubnetCidr := []string{"1x.x.x.x/30"}
Tag := map[string]string{"owner":"xxx"}
awsRegion := "us-east-1"
terraformOptions := &terraform.Options{
// The path to where our Terraform code is located
TerraformDir: "..",
// Variables to pass to our Terraform code using -var options
Vars: map[string]interface{}{
"vpc_cidr": vpcCidr,
"env": Env,
"private_subnet_cidrs": privateSubnetCidr,
"public_subnet_cidrs": publicSubnetCidr,
"tags" : Tag,
},
EnvVars: map[string]string{
"AWS_DEFAULT_REGION": awsRegion,
},
}
// At the end of the test, run `terraform destroy` to clean up any resources that were created
defer terraform.Destroy(t, terraformOptions)
// This will run `terraform init` and `terraform apply` and fail the test if there are any errors
terraform.InitAndApply(t, terraformOptions)
// Run `terraform output` to get the value of an output variable
publicSubnetId := terraform.Output(t, terraformOptions, "public_subnet_ids")
privateSubnetId := terraform.Output(t, terraformOptions, "private_subnet_ids")
vpcId := terraform.Output(t, terraformOptions, "vpc_id")
subnets := aws.GetSubnetsForVpc(t, vpcId, awsRegion)
require.Equal(t, 2, len(subnets))
// Verify if the network that is supposed to be public is really public
assert.True(t, aws.IsPublicSubnet(t, publicSubnetId, awsRegion))
// Verify if the network that is supposed to be private is really private
assert.False(t, aws.IsPublicSubnet(t, privateSubnetId, awsRegion))
}
**
這段代碼是不可測試的,所以你不能測試它。
我希望他們可以像這樣重構它:
var AuthAssumeRoleEnvVar string
func SetAuthAssumeRoleEnvVar(role string){
AuthAssumeRoleEnvVar = role
}
func NewAuthenticatedSession(region string) (*session.Session, error) {
if assumeRoleArn, ok := os.LookupEnv(AuthAssumeRoleEnvVar); ok {
return NewAuthenticatedSessionFromRole(region, assumeRoleArn)
} else {
return NewAuthenticatedSessionFromDefaultCredentials(region)
}
}
這樣我們就可以這樣稱呼它:
aws.SetAuthAssumeRoleEnvVar("testrole")
aws.NewAuthenticatedSession(region)
如文檔中所述,將此變量 TERRATEST_IAM_ROLE 作為 os 環境變量傳遞的唯一方法您也可以將其定義為后端文件,但如果您有讀取值的斷言測試用例,則不會被選中,因為它使用 aws cli
所以我做了一些這樣的事情,它奏效了。
import (
"os"
)
os.Setenv("TERRATEST_IAM_ROLE", "arn:aws:iam::xxxx/xxxx")
聲明:本站的技術帖子網頁,遵循CC BY-SA 4.0協議,如果您需要轉載,請注明本站網址或者原文地址。任何問題請咨詢:yoyou2525@163.com.